A network file system, also referred to as a “distributed file system,” enables access to remote computer files. Network file system client computer programs, referred to herein as “network file system clients” or simply as “clients,” execute on computer systems and may be provided with access to computer files on other computer systems over a computer network. In some systems, network file system clients interact with network file server computer programs (referred to herein as “network file servers”) over the computer network using a protocol in order to obtain access to remote computer files. Exemplary protocols include the Network File System (“NFS”) and Server Message Block (“SMB”), also referred to as the Common Internet File System (“CIFS”).
In order to make a computer file available to remote computer systems, a network file server may export a portion of computer storage (e.g., its underlying file system) that contains the computer file to one or more network file system clients. The clients may be permitted to “mount” the exported portion. “Mounting” an exported portion means making the computer files within available for access and/or manipulation by the client or other applications running on the same computer system as the client. For example, Windows computer systems are able to mount remote computer file storage portions as local “drives” designated by letters (e.g., “g:\”, “h:\”).
Symbolic links (sometimes referred to as “soft links”) are a type of computer file that is created not to hold data, as are most computer files, but instead to contain a reference to another computer file or a directory. The reference may be an absolute path, which indicates exactly where the referred-to computer file is located within computer file storage, or a relative path, which indicates where the referred-to computer file is located relative to the location of the symbolic link.
A client to which a first portion of a network file server's underlying file system is exported may not be permitted to stray from the exported portion. However, if a symbolic link is created within the exported portion that refers to a file or directory that is outside of the exported portion, then the client potentially could gain access to non-exported portions of the network file server's underlying file system.